Nextcloud for GDPR data subject requests and retention

Deleting a Nextcloud user account removes the login, but it does not automatically remove everything that person created. Article 17(1) requires erasure without undue delay when one of six grounds applies, such as data that is no longer necessary for its purpose or a successful objection. A controller that deletes the account and closes the request may still hold the person's name, messages and edits in other places. The EDPB's coordinated enforcement action on the right to erasure, covering 32 data protection authorities and 764 responding controllers, found controllers struggling to determine retention periods and to delete personal data at all. Findings were announced on 18 February 2026.

Comments on files and activity records are the first places to check. Comments written by the user are tied to the account, and activity entries record who uploaded, edited, shared or deleted content. Whether those rows keep the user's display name, a user ID or a placeholder after deletion depends on the installed version and app configuration. Talk messages, reactions and shared conversations form a second store with their own behavior. Confirm the exact outcome for your version in the Nextcloud documentation, then verify it on a staging instance instead of relying on a summary of the admin interface.

Shared files need a separate decision before any deletion runs. Files the deleted user owned may sit in folders or shares that other people still use, so deletion can remove material the organization still needs, or leave shares pointing at content with unclear ownership. Decide in advance whether ownership moves to a retained administrative account, whether content is exported or reviewed, and who signs off. If the organization keeps any of this material, record the business purpose and the period for which it is kept, because Article 5(1)(e) limits retention to what is necessary for that purpose.

Build a test plan on a staging instance that matches production in version, apps and Talk configuration. Create a test user, then generate comments on files that user owns and on files owned by others, activity from uploads, edits and shares, and Talk messages in a group conversation and a one-to-one conversation, including a reaction and a file shared into Talk. Record a baseline, delete the user through the same path your team uses in production, then search and browse each location as an administrator and as a remaining member. Log whose name appears, whether the content is still reachable, and whether anything else changed. Repeat the test after each upgrade. Backups are a separate question and are covered in the retention section.

The place where a Nextcloud instance stores its files is only part of the transfer question. Under Article 44 of the GDPR, every transfer of personal data to a third country, including onward transfers, must meet the conditions in Chapter V. EDPB Guidelines 05/2021 (version 2.0) treat two situations as transfers: remote access from a third country, even where the person only views data on screen for support or administration, and storage in a cloud outside the EEA. For data subject requests, this matters because access, export and erasure work is often done by administrators or support staff. If that work is performed from outside the EEA, handling the request is itself a transfer. Infringements of Articles 44 to 49 can carry fines of up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher.

Start by mapping every party that can reach personal data in the instance and the country each one works from. Article 15(1) requires the access response to name recipients, in particular those in third countries, so an inaccurate inventory produces an inaccurate response. Typical entries include administrators using the occ command line or the web interface, the hosting provider's operations staff, vendor support sessions if you hold a support contract, backup targets such as a BorgBackup repository when you use Nextcloud All-in-One, and any relay service that carries Talk calls, push notifications or outgoing mail. Ask each provider to confirm in writing where its staff log in from, where support tooling stores session data, and whether any sub-processor sits outside the EEA. Record the answers in the processing register so the Article 15 response and the transfer assessment use the same list.

Where a processor is subject to third-country law, the question is legal reach as well as physical location. The US CLOUD Act provision at 18 U.S.C. 2713, added on 23 March 2018, requires electronic communication and remote computing service providers to preserve or disclose data in their possession, custody or control, whether that data sits inside or outside the United States. Article 48 of the GDPR allows a third-country court judgment or administrative decision to be recognized only if it rests on an international agreement in force with the Union or a Member State, such as a mutual legal assistance treaty. EDPB Guidelines 05/2021 (Example 12) explain that using an EU processor subject to third-country law is not itself a transfer, but complying with a third-country authority request would be, so controllers should assess that exposure before engaging the processor. EDPB Recommendations 01/2020 add that where a provider needs data in the clear and third-country powers go beyond what is necessary and proportionate, no effective technical supplementary measure can be envisioned.

Data Privacy Framework status narrows only one route. Commission Implementing Decision (EU) 2023/1795 finds adequate protection only for US organizations on the Data Privacy Framework List, and an appeal against the General Court's September 2025 judgment upholding the decision is pending as Case C-703/25 P. Confirm that the specific legal entity appears on the list, record the date of the check, and plan for the outcome of the appeal. The Court's Schrems II judgment in Case C-311/18 (16 July 2020) invalidated the Privacy Shield decision while holding that standard contractual clauses remained valid, so keep a documented fallback with clauses and a transfer impact assessment. For a Nextcloud estate, the most direct control is self-hosting inside the controller's own infrastructure, with administrator and support access kept within the EEA. Hosting location alone does not settle the analysis, because remote access from abroad and the legal reach of a provider's home state still count.

The EU Data Act adds a separate duty that does not replace the GDPR. Article 32 of Regulation (EU) 2023/2854 requires providers of data processing services to take technical, organizational and legal measures against third-country governmental access to non-personal data held in the Union where that access would conflict with Union or national law. Many Nextcloud instances hold mixed data: audit entries, Talk metadata, comment threads and version history can contain personal data alongside non-personal files. Treat the personal elements under the GDPR and confirm the provider's Data Act measures for the remainder. Before go-live, document the answers in one transfer register, and review it whenever Case C-703/25 P is decided or a sub-processor changes.